1. Field of the Invention
The invention relates generally to electronic security but more particularly to a method for protecting the PIN or password of a user.
2. Background of the Invention
With the constant threat of hackers, piracy, identity theft and so on, one can never be too careful when it comes to doing electronic transactions. One device that is often the target of thieves is the bank's ATM machine. Over the years, a number of strategies have been used to try to steal money from those machines or to gain access to accounts which makes it possible to withdraw cash. Although ATM machines often make the news, other types of devices using card access could be targeted by thieves such as card access doorways, various types of electronic machines, even Internet access from home which may, in years to come, offer the possibility of “reloading” debit cards or prepaid cards from a home terminal.
For this reason, a number of counter strategies have been developped in recent years to foil attempts by thieves and resolve this issue, not just for ATMs but every device requiring a PIN or password for access. To simplify the description, from now on, the use of the expression <<PIN>> will also include password.
U.S. Pat. No. 4,837,422 discloses a card combination which is issued to a single cardholder and which can be reprogrammed by the cardholder for use by a sub-user to a desired extent with regard to value and time. The cardholder uses a master enabling code to access the programming mechanism. He/she assigns a sub-PIN for use by the sub-user and opens a subordinate account for the allowed credit value within card's total credit value. This subordinate account can be accessed using the sub-PIN. A limited term can be selected during which any transaction using the sub-PIN and using the subordinate account can be conducted. After the expiration of that term the sub-PIN is automatically erased and any balance in the suborinate account is re-credited to the main credit account of the card. Such a multi-user card can also be used in conjunction with a program for varying the value of units stored in the credit account.
U.S. Pat. No. 5,239,583 discloses an improvement in structure and credit account access security employing method and means for ensuring that repeating an exact access code which was successful in accessing the account will be unsuccessful at the next or subsequent tries. The user enters a PIN code in accordance with a prescribed, but variable, sequence, the sequence being different for each transaction from the previous transaction. The user inputs the PIN by entering a sequence of alphanumeric symbols in accordance with a prescribed “start” sequence of symbols for recognition as a proper 4-digit PIN for a first transaction. The user must enter a new PIN to access the same account on subsequent tries. Preferably, the sequence of symbols comprising the PIN has only one symbol different from the “start” sequence for recognition as a proper PIN for a second transaction and the third transaction may require yet a third sequence of alphanumeric symbols comprising a third PIN. As many different PINs as desired can be accommodated within reasonable limits.
U.S. Pat. No. 5,251,259 discloses a group of seven PINs assigned to each card holder. The group of PINs are to be used in a specific sequence changing each calendar day. If a PIN is used out of sequence, then access to the charge or credit card is denied by the card company. A grid of numbers and letters are used to vary the PIN each day. The grid includes seven rows and seven columns with the numbers 1 through 7 randomly selected and placed in the seven rows and columns. The rows and columns, when utilized correctly, allow the card holder to access seven three-digit codes. The codes or personal identification numbers must be used in the correct sequence which is determined by the number of uses per calendar day.
U.S. Pat. No. 5,428,349 discloses a password access method/algorithm effected by generating a pseudorandom array of each letter of the alphabet and the numerals 0 through 9 such that the password entry can be monitored without disclosing the letters or numerals contained in the password. The preferred arrangement is a square matrix of six rows and six columns of characters. The user enters the password by selecting either the row or column containing each letter of a memorized password.
U.S. Pat. No. 5,478,994 discloses a secure credit card 10 having a body member to which is attached a microprocessor controller electrically coupled a Programmable Read Only Memory (PROM) device programmed with a series of random numbers in a predetermined sequence. The random numbers are identical to random numbers in a host computer and in the identical sequence as the random numbers in the host computer. This computer is accessible upon each use of the credit card. The Programmable Read Only Memory (PROM) accesses the next random number in sequence with each use of the credit card to permit verification by comparing the random number with each use of the credit card with the next random number in sequence as indicated by the computer. A switch actuated with each use of the credit card provides a pulse signal that activates the microprocessor controller to turn on the Programmable Read Only Memory (PROM) to access the next random number in the sequence. A counter connected to the microprocessor controller counts the number of pulse signals received to count each use of the credit card. A display device displays the next Personal Identification Number (PIN) in the sequence each time a pulse is received.
U.S. Pat. No. 5,724,423 discloses a user authentication service which is both highly secure and user friendly. To access a particular service, a user simply enters a PIN using a portable terminal device which encodes the PIN. More specifically, a character position of the user's PIN is determined, and a random code having a length selectable at each service transaction by the user is generated. The user's PIN is encrypted using one of plural available, pseudo-randomly encrypting algorithms to provide an encrypted PIN. The encrypted PIN is then combined with the code at the determined position before being transmitted over a communications network. When received, the encoded PIN is decoded using an analogous procedure to determine if the user is authorized. A plurality of security levels are provided with each level having a plurality of encryption algorithms and with each increasing level providing encryption algorithms of increasing complexity and sophistication. A user may also change a current PIN from the portable device easily and securely without having to contact a service center.
U.S. Pat. No. 5,754,652 discloses a method for sequentially encrypting the digits of a personal identification number, and an apparatus for practicing the method. According to the method, a random number is generated and supplied to a user requesting access to a system. The user encrypts a digit of his personal identification number by performing a function on the random number and the digit and then provides the encrypted digit to a verification system. A second random number is then generated, provided to the user, applied to encrypt another digit of the user's personal identification number and then input to the verification system. The dialogue between verification system and the user continues, digit by digit, until each digit of the personal identification number has been provided to the verification system in encrypted form. The verification system then compares the encrypted input with the user's personal identification number accessed from memory.
U.S. Pat. No. 6,246,769 discloses a system that eliminates the use and recall of multiple dedicated access codes to verify an authorized user across multiple protected resources. Fixed access codes selected by a user, or issued to a user, such as PINs, passwords and passcodes are replaced by temporary codes that are valid only for the specific transaction in progress. A temporary code is randomly selected by the system and displayed to the user encoded within a completely filled geometric matrix along with other non-code characters. The user must recall a single, predetermined sequential pattern within said matrix in order to obtain the access code. Once the code is obtained, or decoded from the matrix, the user must enter that code into the system. If the entered code matches the transaction specific code in system memory, access to the protected resource is granted and the transaction is allowed to proceed.
U.S. Pat. No. 6,425,523 discloses a method for preventing unauthorized use of credit cards in remote payments and a supplemental-code card for therein. A unique code list is provided by the credit company to the credit card owner for use with the credit card. The codes are distributed in a variety of possible ways, including through ATMs, stores, e-mail or faxes. A copy of each code list is associated at the credit card company with the owner of the credit card. Each code is only for a single use. For every remote payment, the credit card owner transmits one of the codes to the creditor, along with conventional credit card data. The credit card company verifies the transmitted information and accepts or rejects the transaction. The codes may be provided on a supplemental-code card with some mechanism to ensure that each code is used only once.
Canadian patent 2,358,753 discloses a PIN assignation methods which gives a new PIN at the end of each transaction or else, gives out a new modifier which instructs the user on how to modify his PIN on the next transaction. A modifier proposed is a “BME” transformation wherein a user will add a digit at the beginning (B), the end (E) or anywhere in the middle (M) of his regular PIN.
The more basic of such strategies involve a one time use PIN number that a user will select from a card given to him listing all PIN numbers. The obvious disadvantage of this method is that losing or having this card stolen renders the method useless. Another variant is that of a PIN for each day of the week which allows a user to change his PIN according to a listing of digits for each day of the week which are used to modify by simple arithmetics, the PIN number known to the user only.